docs(release): clarify protected main candidate source

[jeremi]

Summary

• make the accepted protected-main revision the explicit candidate and tag source
• document the fail-closed recovery when main advances during the CI wait
• add an exact rehearsal-run wait before opening the release PR

Why

The release CLI now revalidates protected main after waiting for CI. The operations guide still said the release-PR merge commit was unconditionally the source, which was ambiguous once main advanced.

Verification

• python3 -m unittest release/scripts/test_release_rehearsal.py
• git diff --check

Signed-off-by: Jeremi jeremi@users.noreply.github.com

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eced12977f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Correlate the rehearsal run before watching it

When this branch already has an earlier rehearsal and the newly dispatched run has not yet appeared in the Actions listing, --limit 1 selects that earlier run; a prior success can therefore satisfy the documented gate without testing the current branch contents and inputs. The gh run list documentation only promises to list recent filtered runs, and none of these filters identifies this dispatch uniquely. Poll for and uniquely correlate the run using its dispatch identity (such as creation time plus headSha and the input-derived display title), as the candidate-request code already does.

Useful? React with 👍 / 👎.